HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a…

Description

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Scores

EPSS (exploitation in 30 days)

13.8% · top 3.5% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.

Weakness

• n/a
• CWE-444 (opens in a new tab)All about CWE-444 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenio.netty:nettyGHSA-p2v9-g2qv-p635 (opens in a new tab)
• Mavenio.netty:netty-handlerGHSA-p2v9-g2qv-p635 (opens in a new tab)
• Mavenorg.jboss.netty:nettyGHSA-p2v9-g2qv-p635 (opens in a new tab)

References (54)

• https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Final (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/netty/netty/issues/9861 (opens in a new tab)x_refsource_MISCx_transferred
• [druid-commits] 20200131 [GitHub] [druid] ccaominh commented on a change in pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [druid-commits] 20200131 [GitHub] [druid] zachjsh opened a new pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [druid-commits] 20200131 [GitHub] [druid] gianm merged pull request #9300: Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-dev] 20200203 [jira] [Created] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-dev] 20200203 Re: [VOTE] Apache ZooKeeper release 3.6.0 candidate 1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200203 [jira] [Assigned] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb%40%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b%40%3Cnotifications.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [zookeeper-issues] 20200203 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200203 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d%40%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60%40%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [zookeeper-issues] 20200204 [jira] [Resolved] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200209 [jira] [Updated] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b%40%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f%40%3Ccommits.zookeeper.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [zookeeper-issues] 20200209 [jira] [Commented] (ZOOKEEPER-3716) upgrade netty 4.1.42 to address CVE-2019-20444 CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2020:0497 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [cassandra-commits] 20200218 [jira] [Created] (CASSANDRA-15590) Upgrade io.netty_netty-all dependency to fix security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2020:0601 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0606 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0605 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0567 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [spark-issues] 20200309 [jira] [Created] (SPARK-31095) Upgrade netty version to fix security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [spark-reviews] 20200310 [GitHub] [spark] dongjoon-hyun commented on issue #27870: [SPARK-31095][BUILD][2.4] Upgrade netty-all to 4.1.47.Final (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• RHSA-2020:0806 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0811 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0804 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• RHSA-2020:0805 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• [geode-dev] 20200408 Proposal to bring GEODE-7969 to support/1.12 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [geode-dev] 20200408 Re: Proposal to bring GEODE-7969 to support/1.12 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flume-issues] 20200410 [jira] [Created] (FLUME-3363) CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flume-issues] 20200415 [jira] [Updated] (FLUME-3363) CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flume-issues] 20200422 [jira] [Commented] (FLUME-3363) CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200904 [SECURITY] [DLA 2365-1] netty-3.9 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• USN-4532-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• FEDORA-2020-66b5f85ccc (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• DSA-4885 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• [flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [spark-issues] 20210824 [jira] [Created] (SPARK-36572) Upgrade version of io.netty to 4.1.44.Final to solve CVE-2019-20444 and CVE-2019-20445 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-p2v9-g2qv-p635 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-20445](https://trackcve.app/badge/CVE-2019-20445.svg)](https://trackcve.app/cve/CVE-2019-20445)

Record last updated 8 Oct 2026, 21:14 UTC.